nodeSolidServer / nodeSolidServer/node-solid-server

authorize endpoint fails if public jwk doesn't include .alg

未關閉
#1,565 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

還沒有人認領這個 Issue。

主要語言
JavaScript
星號
1.8k
分支
308
PR 合併指標
30 天內沒有已合併 PR

描述

In the guide for the webid-oidc spec, the "Authorization Request" step describes the encoding of the request paramater.

This includes the public key of a JWK in the key field. I'm using a python tool to generate keys (jwcrypto), but when it generates a public key it doesn't include the "alg" field:

{
  "kty": "RSA",
  "n": "sezpNr99QA7xMqkNvpZamVDdkiAn_xvuH2H5nTFKYDKILny3a1hp2ULV2nvumiCt9IsxEuvPjAGRQsPMKwDkCjhzO70EoFyb2k2PzwBk_Fd37xNbl4Nrb4W9zK7Vff5vXmtBOFSSzsUdUf52zZMii7RZBcDQSLcmv63qV_NDpvGNOTadth1nbJhzMtQDQWBlWbClI8Z4R0fGgx7yhQvMqOl6vIlFfricBcoe2nopS51uUbsZSNSkTrGHCsBM_ggvVcWzFAvipkSsplEPhvdT1K7oC4Q6yNG6koPPajpxNnEw05Nh5YHIUcmhFKj76rqaCNtwBejYBxeQp2rwnLekKQ",
  "e": "AQAB"
}

According to the JWK spec, this parameter is optional: https://tools.ietf.org/html/rfc7517#section-4.4

When generating an authorization request, if the key doesn't include alg, node-solid server returns an error. The exception that causes this is:

normalizedAlgorithm = Error: undefined is not a supported algorithm
at SupportedAlgorithms.normalize (node_modules/@solid/jose/src/algorithms/SupportedAlgorithms.js:75:14)
at Function.importKey (node_modules/@solid/jose/src/jose/JWA.js:89:51)
at Function.importKey (node_modules/@solid/jose/src/jose/JWK.js:31:16)
at AuthenticationRequest.loadCnfKey (node_modules/@solid/oidc-op/src/handlers/AuthenticationRequest.js:212:16)
at node_modules/@solid/oidc-op/src/handlers/AuthenticationRequest.js:176:26

It seems that jose.JWA expects that the alg field exists: https://github.com/solid/jose/blob/71ebf31761002bcb18ce88e739a30a8a6459936f/src/jose/JWA.js#L89

I couldn't find any specific webid-oidc documentation that says that alg is required in this case. It might be nice for node-solid-server to return an explicit error message if a submitted key doesn't include it.

貢獻指南

開啟貢獻指南

從這裡開始

  1. 先讀完整個 Issue,再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫,在一個分支上完成修改。
  4. 送出 Pull Request,並在描述裡引用這個 Issue 編號。

研究方向

從 @solid/oidc-op 中的 AuthenticationRequest.loadCnfKey 開始,追蹤經過 @solid/jose/src/jose/JWK.js 和 JWA.js 的 importKey 呼叫。將其行為與 WebID-OIDC authorization-request 指南和 RFC 7517 進行比較;完成條件是缺少 alg 的情況對 authorize 端點有明確且適當的結果。

由索引模型根據 Issue 內容生成。

評估

技術堆疊
javascript, nodejs
領域
authentication, backend
Issue 類型
缺陷
難度
3/5
預估耗時
1-2 天
活躍度
停滯
描述清晰度
基本清楚
新手友好度
35/100

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。